What type of and how many AD groups can the PCS floating license server handle?

[Modesto Vega]

We are getting regular 401 errors when connecting Sparx EA to a PCS floating license server for some AD accounts. We suspect that a possible cause is these AD accounts not belonging to the AD groups mapped to floating license groups through https://www.sparxsystems.com/enterprise_architect_user_guide/15.2/model_repository/webconfig_add_or_edit_group.html.

However, there are a number of other unusual behaviours that do not help diagnosing this:

• In WebConfig, each time we tick the "is Admin" checkbox for a floating license group, the Active Directory Groups box is greyed out. Does this mean that we cannot map an AD group to an admin floating license group. This does not happen with desktop utility.
• We are also seeing numerous occurrences of the following warning on the PCS logs [WARNING]:   [SSKSGroupAM] Failed to load details for group: WINNT://<domain>/<group name>

Any help will be much appreciated.

[Modesto Vega]

What started as a 401 error when connecting Sparx EA to a PCS floating license server is quickly turning into a more complicated problem. We have an ongoing support case but I would also like to reach out to the wider community to find out if anybody has experienced a similar problem or we are trying to do something which is really not supported.

In a nutshell, it is unclear if the PCS floating license server can handle

• multiple AD groups, with overlapping membership, mapped to different floating license groups, and
• AD groups with privileged accounts - please see Appendix B - Privileged Accounts and Groups in Active Directory | Microsoft Docs - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory.

Below is a description of what we are doing and what is happening.

We have at least 9 AD accounts at play - e.g, Account1, Account2, Account3, Account4, Account5, Account6, AdminAccount1, AdminAccount2, & AdminAccount3 (where the AdminAccount1 to 3 are likely to be privileged accounts.

We have at least 3 AD groups at play - e.g., Group1, Group2 & Group3  - with the following membership

• Group 1 consists of Account1, Account2, Account3, Account4, Account5 & Account6
• Group 2 consists of Account1, Account2, Account3, Account4, AdminAccount1, AdminAccount2 & Admin Account3
• Group3 consists of AdminAccount1, AdminAccount2, and AdminAccount3

We have mapped Group1 to the default floating license group, Group2 to the admin floating license group, and created a new floating license group identical to the  default admin group for Group3.

In our environment we are seeing [WARNING]: [SSKSGroupAM] Failed to load details for group for Group1 and Group3 and not for Group2. This explains the 401 error, any accounts belonging to those 2 groups not also in group 2 cannot access the PCS floating license server/store.

There are a number of odd things here:

• Group2 is the 1st group we configured. It originally contained privileged accounts and worked.
• Group1 is mapped against the admin floating group, but when ticking the "Is Admin" check box in the corresponding page of WebConfig the box used to map AD groups is greyed out. This does not happen when using the configuration tool on the VM hosting PCS.
• The 2 failing groups contain mostly privileged accounts but have added a privilege account to Group2 and cannot reproduce the error with this group.
• We thought Group1 originally worked, before adding more accounts to it but are not sure.